Gmail

Gated

google.comSourcedUpdated 27 Oct 2026 · yesterday

You can connect your own account and up to 100 test users the same day. The scopes most Gmail integrations need (gmail.readonly, gmail.modify, gmail.compose) are restricted, so a public launch needs Google's OAuth verification and a paid, annual third-party CASA security assessment. Expect several weeks.

Your work: 3–10 days
Waiting on Gmail: 2–8 weeks
First user connects: Today, in about 30–60 minutes, with your own account added as a test user

3 not confirmed 10 sources Why this tier How did it go?

.md JSON

Use with your agent

Set up a Gmail OAuth app for our integration, as far as you can.
Guide: https://oauth-guide.akshatsethi.com/apps/gmail.md (updated 27 Oct 2026)

Gated. Hands-on work: 3–10 days. Waiting on Gmail: 2–8 weeks.

Check these exist first:
- Google account and Google Cloud project [human]

Needed later, not now:
- Verified domain you own (for launch)
- Public homepage and privacy policy (for launch)
- Demo video (for launch)
- CASA security assessment (paid, annual) (for launch)

Steps, in order:
1. [human] Create a Google Cloud project
2. [agent] Enable the Gmail API. In the API Library, find the Gmail API and enable it for the project.
3. [agent] Configure the OAuth consent screen. In Google Auth Platform, set the user type to External (or Internal for your org only) and fill in branding: app name, support email, logo, homepage, privacy policy, terms, authorized domains and developer contact. Watch out: Use a contact inbox someone monitors. Google sends all verification messages there.
4. [agent] Add the narrowest Gmail scopes you need. On the Data Access page, add only the scopes your live features use. gmail.send is sensitive. gmail.readonly, gmail.modify, gmail.compose, gmail.metadata and https://mail.google.com/ are restricted. Watch out: Scopes on the consent screen must match what your app actually requests. A mismatch is a common reason for rejection.
5. [agent] Create a Web application OAuth client. Create an OAuth client ID of type Web application and add your redirect URI under Authorized redirect URIs. A person should copy the client secret into your OAuth client's configuration. Watch out: Request access_type=offline and prompt=consent so you get a refresh token.
6. [agent] Add test users and connect. While the app is in Testing status, add your account and up to 99 others under Audience > Test users, then run a test connection through your OAuth client. Watch out: In Testing, grants and refresh tokens expire after 7 days, and each test user permanently uses up one of the 100 slots.
7. [human] Verify domain ownership in Search Console
8. [human] Record demo video and write justifications
9. [human] Publish the app and submit for verification
10. [provider] Wait for Trust & Safety review (wait 3–14 days)
11. [human] Complete the CASA security assessment
12. [provider] Wait for CASA and final approval (wait 2–4 weeks)

Rules:
- Do [agent] steps yourself. Steps in Gmail's dashboard need a browser I'm signed in to; without one, give me the exact clicks and values instead, then carry on with the code.
- At each [human] or [provider] step, stop and tell me exactly what's needed.
- Never put client secrets in chat, code or commits. I paste them into our OAuth client or secret manager myself.
- Claims marked Inferred or low confidence in the guide are unverified. Check them and tell me what you find.
- If the guide doesn't match what you see (a page, field or requirement), tell me and report it so it gets fixed: POST https://oauth-guide.akshatsethi.com/api/reports with {"app": "gmail", "step": 2, "message": "what you saw"} (step is optional), or call the report_problem MCP tool. Never put secrets or personal data in a report.
- When setup ends (users can connect, or it's waiting on Gmail's review) or you can't get past a step, report how it went so the guide improves: POST https://oauth-guide.akshatsethi.com/api/reports with {"app": "gmail", "outcome": "worked" | "waiting" | "stuck", "step": 3, "message": "what happened"}, or call the report_setup MCP tool. Stopping for me at a [human] step isn't stuck: don't report that.
- Finish with what's done, the redirect URI and scopes used, and what's left before public launch.

Paste into Claude Code, Cursor or any agent.

Gmail

Plan

SetupBefore you start

BuildYour account

BetaTest users

LaunchPublic launch

Why gated

Scopes

When you get stuck

Not confirmed

Sources

Feedback

Gmail

Plan

SetupBefore you start

BuildYour account

BetaTest users

LaunchPublic launch

Why gated

Scopes

When you get stuck

Not confirmed

Sources

Feedback